How about implementing some way to hide the HTTP referer and spoof useragent strings without the use of extensions? They're not evil forces created by Google, but they can still be used to track the web activity of users.

Oh and why aren't "Do Not Track" & "Block third party cookies" options activated by default? They help privacy a bit.